Avi Shua

Even among the best, mistakes happen. At Black Hat Asia 2025, Corelight's monitoring of the conference network surfaced familiar risks, from apps leaking location and credentials in plaintext to self-hosted tools exposing sensitive systems. It's a reminder that encryption still isn't a default everywhere. Even well-intentioned developers can introduce serious blind spots. This NOC dispatch explores the human errors, outdated defaults, and misconfigurations that still appear, and how network visibility helps catch what other tools miss. 🔎 Read the full breakdown: https://lnkd.in/e92H_zVj #BlackHat2025 #NetworkSecurity #NDR #ThreatDetection

21

The modern #CISO needs to be an enabler, not a blocker, says RenaissanceRe's Gene Zafrin, sitting down to chat with The Stack. Here's how he structures his security team and the simple but important mission statement he's set for them. 👉 https://lnkd.in/e6ceAyCV #CISOs #cyberrisk #leadership

4

AI MCP Server risks continue to surprise many. They shouldn’t. The true challenge here is down the pace of AI velocity: hearing about a new tool > finding it > installing it > trialing it > moving it into production, all in the space of a few minutes. And often with no governance or checks, let alone technical controls. Not through user maliciousness, but through absence of these protection layers. Don’t blame the user, blame the AI Risk owner. Oh. You say you don’t have one? Maybe start there. AI is vital but don’t sacrify security when doing it. A new approach is needed when it comes to AI Security.

5

Trying to get good security telemetry coverage feels a lot like packing for a long trip with just a carry-on. You’re not choosing what to bring. You’re choosing what to leave behind. And you won’t know if you got it right until you’re already there. That’s where many security teams are today. There’s more telemetry available than ever, but you can’t ingest all of it. Volume, cost, complexity, something has to give. So teams choose. Which sources to collect. Which fields to keep. What goes to the SIEM, what goes to cold storage, what gets dropped entirely. The problem is that the tools for making these decisions don’t really guide you. They’re coarse. They don’t always tell you what actually matters from a security perspective. So choices end up driven by budget and gut feel. You skip a source because it’s too noisy. You keep another because it’s always been there. You sample and hope nothing critical gets lost. Over time, this doesn’t turn into a coverage strategy. It turns into a pile of compromises. Each one reasonable in the moment. But zoom out and you see gaps nobody mapped, redundancy nobody cleaned up, and sources stuck in backlog because onboarding felt like too much effort for unclear payoff. How many sources are sitting in your backlog right now, because the effort to onboard them wasn't worth it? That number tells you a lot about whether your current model is working.

30

Australian Signals Directorate (ASD) today released information on requirements for companies that produce software products, to have a Software Bill of Materials. (SBM) Its a tool that can be used to better secure your supply chain. More information can be found at the following link. If you don't have a SBM report for your company, then please reach out to organise. #SBM #REGCOR #CYBERSECURITY https://lnkd.in/gPbNZJW7

4

Here’s a pattern I’m seeing more often: More sites. More assessments. More reporting expectations. Same headcount. Security teams are being asked to scale output without scaling structure. So what happens? Assessments become episodic. Reporting takes too long. Prioritization becomes subjective. And leaders spend more time translating risk than reducing it. This isn’t a capability issue. It’s an architecture issue. At some point, physical security has to operate with the same operational discipline as finance and IT. Otherwise it stays in permanent catch-up mode. For security people overseeing medium to large portfolios (20+ sites): What’s currently your biggest bottleneck volume, visibility, or validation? And why do you think this is?

5

1 Comment